3 ms·

Let’s call a spade a spade. The only real world problem that WebBundles (and Signed Exchanges) really solve is to allow AMP to impersonate your website. Google

by cflat 6y ago

Let’s call a spade a spade. The only real world problem that WebBundles (and Signed Exchanges) really solve is to allow AMP to impersonate your website. Google wants all the click data and the click through navigation data about users (by way of passive logs) so they can sell more ads. There are no other real world problems that web bundles solve.

judge2020 6y ago
Links on the page are the same as before signed, so the only actual problem with them is not being able to change/delete the documents hosted elsewhere immediately.
- cflat 6y ago
  Yea, but the web server delivering them is now google. Google now gets the access logs and using the persistent tls socket can follow the users activity. Sure the content is signed, but the delivery is no longer private.
  - Spivak 6y ago
    Because of CDNs the delivery was never all that private to begin with.
    - cflat 6y ago
      CDNs are a known commodity with business relationships. You can’t have an unknown CDN in the mix. They are an extension of your infrastructure and you can control if they are or aren’t in the path of control. They key here is that there is also a legal and business relationship.
      - deleted 6y ago
        [deleted]
  - dlubarov 6y ago
    > Google now gets the access logs It doesn't seem like this would materially change the information Google receives. The status quo is that Google knows (via redirect links) what search results I click and when. It doesn't technically know what data the website will send me, but normally it's the same as Google's cached copy. It doesn't know what resources my browser will block, but in a bundle scenario, my browser is free to ignore resources even if they must be transmitted as part of a bundle. > using the persistent tls socket can follow the users activity Even if this caused browsers to keep idle sockets to Google alive more often, what information is there to be gained from an idle socket?
Spivak 6y ago
The real world problem web bundles solve is distributed caching. Right now sites have pick one or a few CDNs and have a trust relationship with them and allow them to impersonate your site. Web bundles changes this relationship so that anyone can cache sites if it benefits them to do so. If you share a link on Twitter or Facebook or Discord or Slack they can cache the page on their servers and deliver it through the connection you already have open to them. Web Bundles also open the door for network-local caches that don’t require MitM or trusting the cache.
- cflat 6y ago
  This feels contrived. Rarely do I, as a brand or content creator, want it circulating without my control. It doesn’t make business sense.
  - spankalee 6y ago
    It's not without your control. You don't have to use bundles or signed exchanges. You can use bundles without signed exchanges. You can bundle only some resources, and leave plenty of things like dynamic content, comments, ads, etc. unbundled. It's a file format, there will be lots of uses.
  - Spivak 6y ago
    This feels like such a weird stance. I can’t imagine someone saying something to the effect of “I don’t want my DNS records just circulating without my control.” This isn’t like AP giving CNN republishing rights, this is getting a magazine from the stand at the convenience store rather than having going to the Condé Nast corporate HQ. Like it’s your site, exactly as it would be if it was delivered by your server just delivered by someone who already had a copy on hand rather than fetching a new one every time. This is what HTTP proxies used to do, what DNS caches and browsers still do. TLS broke web caches because TLS secured the connection instead of the content.
    - jariel 6y ago
      It's not weird to reject arbitrary complexity. The most important issues is the 'lack of value' - not anything else. Complexity compounds to imbue cost geometrically, we don't need stuff 'because', we need stuff that solves real problems.

by cflat 6y ago

judge2020 6y ago

Links on the page are the same as before signed, so the only actual problem with them is not being able to change/delete the documents hosted elsewhere immediately.

cflat 6y ago
Yea, but the web server delivering them is now google. Google now gets the access logs and using the persistent tls socket can follow the users activity. Sure the content is signed, but the delivery is no longer private.
- Spivak 6y ago
  Because of CDNs the delivery was never all that private to begin with.
  - cflat 6y ago
    CDNs are a known commodity with business relationships. You can’t have an unknown CDN in the mix. They are an extension of your infrastructure and you can control if they are or aren’t in the path of control. They key here is that there is also a legal and business relationship.
    - deleted 6y ago
      [deleted]
- dlubarov 6y ago
  > Google now gets the access logs It doesn't seem like this would materially change the information Google receives. The status quo is that Google knows (via redirect links) what search results I click and when. It doesn't technically know what data the website will send me, but normally it's the same as Google's cached copy. It doesn't know what resources my browser will block, but in a bundle scenario, my browser is free to ignore resources even if they must be transmitted as part of a bundle. > using the persistent tls socket can follow the users activity Even if this caused browsers to keep idle sockets to Google alive more often, what information is there to be gained from an idle socket?

Spivak 6y ago

The real world problem web bundles solve is distributed caching. Right now sites have pick one or a few CDNs and have a trust relationship with them and allow them to impersonate your site. Web bundles changes this relationship so that anyone can cache sites if it benefits them to do so. If you share a link on Twitter or Facebook or Discord or Slack they can cache the page on their servers and deliver it through the connection you already have open to them. Web Bundles also open the door for network-local caches that don’t require MitM or trusting the cache.

cflat 6y ago
This feels contrived. Rarely do I, as a brand or content creator, want it circulating without my control. It doesn’t make business sense.
- spankalee 6y ago
  It's not without your control. You don't have to use bundles or signed exchanges. You can use bundles without signed exchanges. You can bundle only some resources, and leave plenty of things like dynamic content, comments, ads, etc. unbundled. It's a file format, there will be lots of uses.
- Spivak 6y ago
  This feels like such a weird stance. I can’t imagine someone saying something to the effect of “I don’t want my DNS records just circulating without my control.” This isn’t like AP giving CNN republishing rights, this is getting a magazine from the stand at the convenience store rather than having going to the Condé Nast corporate HQ. Like it’s your site, exactly as it would be if it was delivered by your server just delivered by someone who already had a copy on hand rather than fetching a new one every time. This is what HTTP proxies used to do, what DNS caches and browsers still do. TLS broke web caches because TLS secured the connection instead of the content.
  - jariel 6y ago
    It's not weird to reject arbitrary complexity. The most important issues is the 'lack of value' - not anything else. Complexity compounds to imbue cost geometrically, we don't need stuff 'because', we need stuff that solves real problems.